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and mouse 220 all connected via a common bus 222. In operation the central 
processing unit 202 will execute computer program instructions that may be stored in 
one or more of the random access memory 204, the read only memory 206 and the 
hard disk drive 210 or dynamically downloaded via the network interface card 208. 
5 The results of the processing performed may be displayed to a user via the display 
driver 212 and the monitor 214. User inputs for controlling the operation of the 
general purpose computer 200 may be received via the user input output circuit 216 
from the keyboard 21 8 or the mouse 220. It will be appreciated that the computer 
program could be written in a variety of different computer languages. The computer 

10 program may be stored and distributed on a recording medixim or dynamically 

downloaded to the general purpose computer 200. When operating under control of 
an appropriate computer program, the general purpose computer 200 can perform the ~ 
above described techniques and can be considered to form an apparatus for 
performing the above described technique. The architecture of the general purpose 

15 computer 200 could vary considerably and Figure 6 is only one example. 

Although illustrative embodiments of the invention have been described in detail 
herein with reference to the accompanying drawings, it is to be understood that the 
invention is not limited to those precise embodiments, and that various changes and 
20 modifications can be effected therein by one skilled in the art without departing fi-om the 
scope and spirit of the invention as defined by the appended claims. 

WE CLAIM: 

25 1. A computer program product for controlling a computer, said computer 
program product comprising: 

malware infection detecting logic operable to detect a malware infection of at 
least one computer; and 

device disabling logic operable upon detection of said malware infection to 
30 disable operation of one or more data I/O devices of said at least one computer. 



2. A computer program product as claimed in claim 1, wherein said malware 
infection detection logic detects a malware infection by one or more of: 

positively identifying an item of malware upon said at least one computer; and 
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identifying behaviour of said at least one computer indicative of malware 
infection. 

3. A computer program product as claimed in claim 1, wherein said one or more 
5 data I/O devices include one or more of: 

a floppy disk drive; 

a compact disk drive; 

a removable media drive; and 

a network interface card. 

10 

4. A computer program product as claimed in claim 1, wherein said device 
disabling logic is operable upon detection of malware infection to disable at least one 
data I/O device of at least one further computer. 

15 5. A computer program product as claimed in claim 1, wherein said device 
disabling logic is operable to require user confirmation prior to disabling said one or 
more data I/O devices. 

6. A computer program product as claimed in claim 1, wherein said device 
20 disabling logic is operable to disable said one or more data I/O devices using an API 

call to an operating system of said at least one computer. 

7. A computer program product for controlling a computer, said computer 
program product comprising: 

25 device disabling logic operable upon receipt by a computer of a command 

indicative of malware infection precautions being taken to disable operation of one or 
more data I/O devices of said computer. 

8. A computer program product as claimed in claim 7, wherein said one or more 
30 data I/O devices include one or more of: 

a floppy disk drive; 

a compact disk drive; 

a removable media drive; and 

a network interface card. 



9 
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9. A computer program product as ciaimed in claim 7, wherein said device 
disabling logic is operable to disable said one or more data I/O devices using an API 
call to an operating system of said at least one computer. 

5 

10. A computer program product for controlling a computer, said computer 
program product comprising: 

user input logic operable to receive a user input indicative of activating 
precautions against a malware infection; and 
10 device disabling logic operable upon receipt of said user input to disable 

operation of one or more data I/O devices of said at least one computer. 

11. A computer program product as claimed in claim 1 0, wherein said one or more 
data I/O devices include one or more of: 

15 a floppy disk drive; 

a compact disk drive; 

a removable media drive; and 

a network interface card. 

20 12. A computer program product as claimed in claim 10, wherein said device 
disabling logic is operable upon detection of malware infection to disable at least one 
data I/O device of at least one fiirther computer. 

13. A computer program product as claimed in claim 10, wherein said device 
25 disabling logic is operable to disable said one or more data I/O devices using an API 

call to an operating system of said at least one computer. 

14. A method of protecting against malware infection, said method comprising the 
steps of: 

30 detecting a malware infection of at least one computer; and 

upon detection of said malware infection disabling operation of one or more 
data I/O devices of said at least one computer. 
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15. A method as claimed in claim 14, wherein detection of a malware infection is 
by one or more of: 

positively identifying an item of malware upon said at least one computer; and 
identifying behaviour of said at least one computer indicative of malware 
5 infection. 

16. A method as claimed in claim 14, wherein said one or more data I/O devices 
include one or more of: 

a floppy disk drive; 
10 a compact disk drive; 

a removable media drive; and 
a network interface card. 

17. A method as claimed in claim 14, wherein upon detection of malware 
1 5 infection at least one data I/O device of at least one further computer is disabled. 

18. A method as claimed in claim 14, wherein user confirmation is reqxiired prior 
to disabling said one or more data I/O devices. 

20 19. A method as claimed in claim 14, wherein disabling said one or more data I/O 
devices uses an API call to an operating system of said at least one computer. 

20. A method of protecting against malware infection, said method comprising the 
steps of: 

25 upon receipt by a computer of a command indicative of malware infection 

precautions being taken disabling operation of one or more data I/O devices of said 
computer. 

21. A method as claimed in claim 20, wherein said one or more data I/O devices 
30 include one or more of: 

a floppy disk drive; 

a compact disk drive; 

a removable media drive; and 

a network interface card. 
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22, A method as claimed in claim 20, wherein disabling said one or more data I/O 
devices uses an API call to an operating system of said at least one computer. 

5 23 . A method of protecting against malware infection, said method comprising the 
steps of: 

receiving a user input indicative of activating precautions against a malware 
infection; and 

upon receipt of said user input disabling operation of one or more data I/O 
10 devices of said at least one computer. 

24. A method as claimed in claim 23, wherein said one or more data I/O devices 
include one or more of: 

a floppy disk drive; 
15 a compact disk drive; 

a removable media drive; snd 
a network interface card. 

25. A method as claimed in claun 23, wherein upon detection of malware 
20 infection disabling at least one data I/O device of at least one further computer. 

26. A method as claimed in claim 23, wherein disabling said one or more data I/O 
devices uses an API call to an operating system of said at least one computer. 

25 27. Apparatus for protecting against malware infection, said apparatus 
comprising: 

a malware infection detector operable to detect a malware infection of at least 
one computer; and 

a device disabling unit operable upon detection of said malware infection to 
30 disable operation of one or more data UO devices of said at least one computer. 

28. Apparatus as claimed in claim 27, wherein said malware infection detector 
detects a malware infection by one or more of: 

positively identifying an item of malware upon said at least one computer; and 
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identifying behaviour of said at least one computer indicative of malware 
infection. 

29, Apparatus as claimed in claim 27, wherein said one or more data I/O devices 
5 include one or more of: 

a floppy disk drive; 

a compact disk drive; 

a removable media drive; and 

a network interface card. 

10 

30. Apparatus as claimed in claim 27, wherein said device disabling unit is 
operable upon detection of malware infection to disable at least one data I/O device -of 
at least one further computer. 

15 31. Apparatus as claimed in claim 27, wherein said device disabling imit is 
operable to require user confirmation prior to disabling said one or more data I/O 
devices. 

32. Apparatus as claimed in claim 27, wherein said device disabling unit is 
20 operable to disable said one or more data I/O devices using an API call to an 

operating system of said at least one computer. 

33. Apparatus for protecting against malware infection, said apparatus 
comprising: 

25 a device disabling unit operable upon receipt by a computer of a command 

indicative of malware infection precautions being taken to disable operation of one or 
more data I/O devices of said computer. 

34. Apparatus as claimed in claim 33, wherein said one or more data I/O devices 
30 include one or more of: 

a floppy disk drive; 

a compact disk drive; 

a removable media drive; and 

a network interface card. 
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35. Apparatus as claimed in claim 33, wherein said device disabling unit is 
operable to disable said one or more data I/O devices using an API call to an 
operating system of said at least one computer. 

5 

36. Apparatus for protecting against malware infection, said apparatus 
comprising: 

a user input unit operable to receive a user input indicative of activating 
precautions against a malware infection; and 
10 a device disabling unit operable upon receipt of said user input to disable 

operation of one or more data I/O devices of said at least one computer. 

37. Apparatus as claimed in claim 36, wherein said one or more data I/O devices 
include one or more of: 

15 a floppy disk drive; 

a compact disk drive; 

a removable media drive; and 

a network interface card. 

20 38. Apparatus as claimed in claim 36, wherein said device disabling unit is 
operable upon detection of malware infection to disable at least one data I/O device of 
at least one further computer. 

39. Apparatus as claimed in claim 36, wherein said device disabling imit is 
25 operable to disable said one or more data I/O devices using an API call to an 
operating system of said at least one computer. 
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